Source IP Address Based on User

If you want to use different source IP addresses based on the logged in user or running service on a Linux computer you can use these simple commands: /sbin/ifconfig eth0:1 NEW-IP-ADDRESS netmask YOUR-NORMAL-NETMASK /sbin/iptables -t nat -A POSTROUTING -m owner –uid-owner USERNAME -j SNAT –to-source NEW-IP-ADDRESS You can use this if the source IP is …

Continue reading ‘Source IP Address Based on User’ »

Ubiquiti UniFi the Next Botnet ?

I tested a Ubiquiti access point today. UAP-AC-Lite seems to be a very good and cheap access-point. When you take it out of the box and connect it to the network it gets an IP address using DHCP and waits for a configuration. In this mode it sends broadcasts to find a controller and listens on port …

Continue reading ‘Ubiquiti UniFi the Next Botnet ?’ »

PaloAlto Packet Loss of 1% and More

Problem: PaloAlto firewall is dropping packets in small bursts of some seconds, and sometimes it drops TCP connections. It only happens on HA clusters on interfaces in active/passive (fail over) mode. Solution: disable the following check box in the Ethernet interface Advanced – LLDP settings: “Enable in HA Passive State” Discussion: Palo Alto uses only one MAC address …

Continue reading ‘PaloAlto Packet Loss of 1% and More’ »

ARP is not working on Cisco ASR 1001 X

Problem: Cisco ASR router is loosing connectivity to its directly attached Ethernet neighbors. In this situation interface status is still up, packets are going in and out on both ends, even IPv6 was still working. The actual problem was that the Cisco ASR was ignoring all ARP responses from its neighbors and the ARP table to this …

Continue reading ‘ARP is not working on Cisco ASR 1001 X’ »

ASR Tips’n’Tricks

ASR-1001-X and IOS-XE is sometimes different and sometimes very similar to classic IOS. Update. You can update, the firmware as usual: # copy http: bootflash: # conf t (config)# boot system flash bootflash:asr1001x-universalk9.03.16.00.S.155-3.S-ext.SPA.bin Show SFP (transceiver) info: # show hw-module interface tenGigabitEthernet 0/0/0 transceiver status # show hw-module interface tenGigabitEthernet 0/0/0 transceiver idprom .. to be continued

MLPPP over L2TP over Ethernet Channel Groups on Cisco ASR

  Problem: After upgrading an ethernet port to a channel-group, all MLPPP connections fail on a Cisco ASR 1002-X. The log file looks like this: Jul 31 2015 07:04:44.801 CEST: Vi4 PPP: Phase is AUTHENTICATING, Authenticated User Jul 31 2015 07:04:44.801 CEST: Vi4 CHAP: O SUCCESS id 143 len 4 Jul 31 2015 07:04:44.801 CEST: Vi4 …

Continue reading ‘MLPPP over L2TP over Ethernet Channel Groups on Cisco ASR’ »

F5 data flood

Problem: A F5 load balancer LTM sends lots of data to some clients. Sometimes this fills up all the available bandwidth with 1 Gbit or more. At the same time the input traffic does not raise. The traffic charts look like if F5 is attacking some clients (reversed DDoS :-) ) Discussion: After some time of staring …

Continue reading ‘F5 data flood’ »

Cisco ASR 1002-X and PPTP

Problem: PPTP from any client to an ASR1002-X Cisco does not work. PPTP Connections starts but in PPP LCP phase the connection fails. Solution: Cisco ASR1002-X with Software IOS-XE 15.3(2)S2 has no PPTP support. You have to take a different Router! Discussion: The weird thing is, that most of the PPTP stack is still configureable and working, …

Continue reading ‘Cisco ASR 1002-X and PPTP’ »

AVM Fritz!box DHCP Problem

Problem: I wanted to provide a CWMP (TR-069) ACS URL to an AVM modem using DHCP on the WAN Interface, but the DHCP server ignores this vendor-option. Discussion: Following the TR-069 specs, the CWMP-ACS Server can be included in an dhcp response using vendor-option (SubOption 1). Usually vendor options should work with isc-dhcp-servers like that: …

Continue reading ‘AVM Fritz!box DHCP Problem’ »

Update Cisco Catalyst Software

I had to update the software of a new Cisco Catalyst 4948 yesterday. As usual I did: copy tftp://<hostname>/<filename> bootflash: conf t boot system flash bootflash:<filename> exit reload But the switch ignored the new software image. During boot it said: Booting first image from bootflash Solution: The config-register was set to 0x2101 right out of …

Continue reading ‘Update Cisco Catalyst Software’ »